Governed AI for Turkish institutions,
built for the export consignment, the supplier file, the bank and the site record

CBAM: emissions data that has to survive a verifier in another country

The EU Carbon Border Adjustment Mechanism requires importers into the EU to report the emissions embedded in covered goods, including iron and steel, aluminium, cement, fertiliser, hydrogen and electricity. Turkey is one of the EU's largest suppliers in exactly those categories, and because the customs union has made European industrial trade the default rather than the exception, the obligation reaches Turkish producers as a practical matter even though it formally sits with the importer. The mechanism has been running through a transitional reporting phase ahead of the definitive regime, and its detailed rules continue to be refined at EU level, so the prudent working assumption is that the evidentiary bar rises rather than falls.

What that means operationally is unglamorous and specific. Emissions have to be attributable per consignment, back to the installation that produced the goods, the production route, the calculation method used and the verification behind it. Default values against actual data, system boundaries, precursor materials, the electricity attributed to a production step and any carbon price already paid each have to be traceable to a source. Where AI assists -- reconciling energy meter series, allocating emissions across production routes, drafting a report, checking a declaration for internal consistency -- the platform validates the input before the model runs, validates what comes back against the producer's own rules, and writes one immutable ledger row for every call: actor, action, inputs, outputs, model version and verdict. A number that cannot be traced back to its source is a number that fails. KriftAI does not make an installation compliant -- the organization carries that obligation. It makes the evidence tractable.

KVKK, VERBİS and cross-border transfer

Kişisel Verilerin Korunması Kanunu, the personal data protection law, is supervised by the KVKK authority. Data controllers register in VERBİS, processing rests on a lawful basis with explicit consent held to a demanding standard, and data subjects hold rights that have to be answered within defined periods. The law is closely modelled on the European approach without being identical, which is precisely the trap: assuming a European programme transfers unchanged produces gaps, and assuming nothing transfers produces duplicated work and inconsistent answers to the same question.

Cross-border transfer is where the difference has been most consequential. The transfer regime was amended to introduce standard contractual clauses alongside the existing routes, which changes the mechanics for a Turkish subsidiary sending personal data to a European parent, a cloud region abroad or a group HR or CRM system. The platform enforces this where it actually bites, at the call: minimization at the point of capture, role-scoped access, content-logging modes that store a verifiable fingerprint rather than the content itself, an immutable record of every access, and certified deletion producing a tamper-evident certificate when a dataset must genuinely be gone. Where a model call would route personal data outside the permitted boundary, the call is blocked rather than flagged, an override escalates to a named person, and the override decision is itself written to the ledger with its reason.

Automotive, white goods and machinery: the supplier record European buyers require

Turkey's manufacturing base is deep and tiered: vehicle and commercial vehicle assembly, a very large components industry, white goods production at European scale, and machinery and metal fabrication supplying plants across the continent. Bursa, Kocaeli and the wider Marmara industrial belt sit at the centre of it, with Istanbul, Izmir, Adana and Konya carrying substantial capacity of their own. Those plants feed assembly lines whose customers impose supplier quality regimes -- part approval, traceability from batch to build, change control, corrective action -- and, increasingly, supply chain due diligence obligations that reach several tiers back toward raw material.

AI is already used across that work: defect classification from inspection images, predictive maintenance, yield and scrap analysis, warranty claim triage, demand and capacity planning. Each of those touches a record a customer or a regulator may later ask about. The governed chokepoint validates the input before the model runs, validates the output against the plant's own rules, escalates to a named person wherever the answer would release or reject material, and writes an audit row for every call. When a customer audit asks how a classification was reached on a particular date, the answer is a record that can be re-run exactly as it stood, not a recollection of what the system probably did.

Textiles and apparel under buyer-driven due diligence

Textiles, apparel, home textiles and leather remain a major export sector, concentrated around Istanbul, Bursa, Denizli, Izmir and Gaziantep, with a supplier base that runs from integrated mills to small subcontracted workshops. The pressure in this sector comes less from a single domestic regulator than from buyers: European brands and retailers carry their own due diligence and reporting obligations, and they discharge them by demanding evidence from suppliers -- facility audits, subcontractor disclosure, chemical management, wastewater and energy data, working-hours and wage records, and increasingly product-level environmental information.

That evidence has to be consistent across buyers, defensible when a third-party auditor arrives, and reproducible a year later when a claim is questioned. Where AI assists in consolidating audit findings, screening subcontractors, classifying materials, drafting compliance packs or reconciling consumption data, the input is validated before the model runs and the output is validated against the supplier's own rules before it reaches a buyer-facing document, with escalation to a named person wherever a claim about labour, chemicals or emissions would be asserted to a customer. An unverifiable claim in a due diligence pack is worse than an acknowledged gap, because it converts a factual question into a credibility one.

BDDK supervision, the TCMB and a large participation banking segment

The Banking Regulation and Supervision Agency (BDDK) supervises banks and a range of non-bank financial institutions, while the Central Bank of the Republic of Türkiye (TCMB) conducts monetary policy and operates the payment infrastructure. The SPK regulates securities markets, and a separate authority supervises insurance and private pensions. Alongside conventional banks, Turkey has a substantial participation (Islamic) banking segment whose products must satisfy prudential supervision and a Shariah governance process at the same time, which means a second, independent line of documentary review over the same transactions.

AML and sanctions screening, credit and behavioural scoring, fraud detection, collections, supervisory returns and customer communications increasingly involve model calls, and each call is a point at which evidence is either created or lost. Running them through one governed chokepoint produces evidence in a form a supervisor, an internal audit function, an external auditor and -- for participation banking -- a Shariah governance review each accept without a translation exercise afterwards. Screening is enforced rather than advisory: a hit blocks the call, an override escalates to a named person, and the override is written to the ledger with its reason. Produce the evidence once, and let it be read many times.

Contracting across jurisdictions: project, payment and compliance records that must reconcile abroad

Turkish contractors are among the most internationally active in the world, running projects across Central Asia, the Gulf, Africa, Europe and beyond, frequently in joint ventures with local partners and financed by export credit agencies and development banks. A single project can involve design to one jurisdiction's codes, procurement in a third country, labour drawn from several, payment terms in more than one currency, and lender conditions carrying their own reporting, environmental and anti-corruption requirements.

Records therefore have to reconcile across legal regimes that do not share definitions. Where AI assists in tender analysis, quantity take-off, claims and variation assessment, schedule risk, subcontractor screening or payment certification, the platform enforces validation at the call and role-scoped access so the contractor, the joint venture partner, the client, the lender and the independent engineer each see exactly what their mandate permits and no more. Offline-capable enforcement matters here in a way it does not in a head office: a site with intermittent connectivity still validates and still writes to the ledger, and records created while disconnected reconcile cleanly when the link returns. When a claim is contested -- and on a large international project it will be -- the answer is a record both parties can read rather than two assertions in a room.

Building inspection, permitting and the structural record

Much of Turkey is seismically active, and the building control regime exists because those records carry public-safety weight: licensed building inspection organizations, permitting and occupancy certification, material testing laboratories and structural documentation. Design calculations, soil and geotechnical reports, concrete and reinforcement test results, inspection sign-offs, as-built drawings and subsequent modification approvals together form the evidence that a structure is what it is claimed to be, and they are consulted long after the people who produced them have moved on.

Where AI assists in reviewing design documents, screening inspection reports, classifying material test results, prioritising retrofit assessments or building an inventory of existing stock, the requirement is not novelty but traceability: which document, which version, which model, which assumptions, reviewed by whom and on what date. The platform validates inputs before the model runs, validates outputs against the organization's own rules, escalates to a qualified person wherever a determination bears on structural adequacy or occupancy, and writes an immutable row for every call. No platform makes a building safe -- engineers, inspectors and the regulatory regime do that. What a governed record does is make it possible to establish, years later and under scrutiny, exactly what was checked, by whom, and on what basis.

On-premise deployment inside Turkish facilities

Enforcement, inference and audit logging run inside the institution's own environment -- a data centre in Istanbul or Ankara, a plant in Bursa or Kocaeli, a bank's own infrastructure, a ministry's server room. Data does not leave the perimeter in order to be processed, which is the only version of data residency that actually holds.

Air-gapped operation as a supported configuration

For supervisory returns, customer files, sensitive engineering work or installation data a producer will not expose, deploy with no outbound path at all. The platform does not phone home for telemetry, licence checks or model routing, so an air gap is a supported configuration rather than a degraded one.

Offline-capable enforcement on lines, sites and terminals

Governance does not pause when connectivity does. On a production line, at a port or logistics terminal, on a construction site, at a remote quarry or in an overseas project office, validation still executes and the ledger still writes, and records created while disconnected reconcile cleanly when the link returns.

Jurisdictional residency for KVKK transfers and EU-facing reporting

A Turkish subsidiary reporting to a European parent, a CBAM data flow reaching an EU importer and a group system holding employee data each touch more than one legal regime. Deploy so that data governed by KVKK transfer conditions stays where those conditions require, with jurisdiction-specific policy enforced at the same chokepoint rather than in separate systems that drift apart.